diff -Nur php5-5.2.4/ext/standard/formatted_print.c php5-5.2.4.new/ext/standard/formatted_print.c --- php5-5.2.4/ext/standard/formatted_print.c 2007-06-03 05:12:04.000000000 -0400 +++ php5-5.2.4.new/ext/standard/formatted_print.c 2008-07-10 17:05:41.000000000 -0400 @@ -76,6 +76,7 @@ register int npad; int req_size; int copy_len; + int m_width; copy_len = (expprec ? MIN(max_width, len) : len); npad = min_width - copy_len; @@ -86,11 +87,19 @@ PRINTF_DEBUG(("sprintf: appendstring(%x, %d, %d, \"%s\", %d, '%c', %d)\n", *buffer, *pos, *size, add, min_width, padding, alignment)); + m_width = MAX(min_width, copy_len); - req_size = *pos + MAX(min_width, copy_len) + 1; + if(m_width > INT_MAX - *pos - 1) { + zend_error_noreturn(E_ERROR, "Field width %d is too long", m_width); + } + + req_size = *pos + m_width + 1; if (req_size > *size) { while (req_size > *size) { + if(*size > INT_MAX/2) { + zend_error_noreturn(E_ERROR, "Field width %d is too long", req_size); + } *size <<= 1; } PRINTF_DEBUG(("sprintf ereallocing buffer to %d bytes\n", *size));